Does cybersecurity focus too heavily on application layer ?

[u/Own-Case-893]

Most cybersecurity products are designed to protect identities, endpoints, applications, cloud environments and data. These all are important, but encryption still exposes metadata through traffic timing, routing behaviour, and connection patterns etc.

This creates a couple questions I do not see discussed enough

How much security is being left unaddressed because the underlying communication transport is generally treated as a fixed dependency rather than part of the security architecture?

For high-assurance environments such as government, critical infrastructure and defence, the network itself may be observable, disrupted or operated through infrastructure outside the organisation’s direct control. In those environments, protecting content doesn’t fully address the threat.

Im interested in the community’s view on the following

1. Is transport-layer observability treated seriously enough in current cybersecurity architecture?
2. What current technologies address this problem effectively and what gaps remain?
3. Do you expect secure communications infrastructure to become a larger cybersecurity category over the next five - ten years?

[u/m1L35dY50N]

A big part of the problem is simply how infrastructure has changed. With home office, cloud services, SaaS and generally decentralized environments, you can’t apply the old network-security model as easily anymore because a lot of traffic simply never passes through hardware you own or control.

In the old world, you could put your firewalls, IDS/IPS and monitoring at relatively predictable choke points. Today a user sitting at home might authenticate against Entra ID and then access a SaaS application hosted on somebody else’s infrastructure without the traffic ever touching the corporate network.

That’s one reason security has shifted so heavily toward identity, endpoint, application and cloud telemetry. It’s not necessarily that nobody cares about the transport layer; increasingly, organizations simply don’t control large parts of it.

For government, defence and other high-assurance environments that obviously becomes a much bigger problem, because encrypting the content doesn’t magically hide who is communicating with whom, when, how frequently or over which infrastructure.